Cryptographers were not fond of DUAL_EC. They also recommended against DES and MD5 long before attacks really appeared.